EP1105998A1

EP1105998A1 - Method and device for creating a secret communication key for a predetermined asymmetric and cryptographic key-pair

Info

Publication number: EP1105998A1
Application number: EP99952301A
Authority: EP
Inventors: Gerhard Hoffmann; Klaus Lukas
Original assignee: Siemens AG
Current assignee: Infineon Technologies AG
Priority date: 1998-08-18
Filing date: 1999-08-04
Publication date: 2001-06-13
Anticipated expiration: 2019-08-04
Also published as: EP1105998B1; DE59906890D1; JP2002523974A; JP4528442B2; WO2000011833A1; DE19837405A1; US7050584B1

Abstract

The present invention involves determining a pair of keys comprising a public key and a corresponding secret key from an initial value, and sending this initial value to an user. The secret key can be erased. If the user wants to carry out a cryptographic operation based on the public-key techniques, said user inputs the initial value into a computer and, thanks to said initial value, receives a secret communication key that corresponds to the secret key previously generated but erased since.

Description

description

Method and arrangement for forming a secret communication key for a previously determined asymmetrical cryptographic key pair

The invention relates to a method and an arrangement for forming a secret communication key for a previously determined asymmetrical key pair.

The formation of an asymmetric cryptographic key pair is known from [1].

In this method, the RSA method for forming a cryptographic key pair, which comprises a secret key and a corresponding public key, is formed.

The secret key is only known to the user, the public key can be made known to all participants in a communication network.

When creating a digital signature to protect the authenticity and integrity of electronic data, the user signs the data with his secret key. The signed digital signature is verified using the public key corresponding to the secret key, as a result of which the authenticity or integrity of the digital signature can be checked by all communication partners who have access to the public key.

The so-called public key technology described above is particularly found in digital communication within a computer network (a predefinable number of computer memories). ten that are connected to each other via a communication network) application.

In the method known from [1], protecting the secret key from unauthorized access by a third party is essential for the security of the digital signature.

From [2] it is known to store the secret key on an external medium for storing data, for example a chip card, a floppy disk, etc. or on a hard disk, key data using a personal identification code (Personal Identification Number, PIN) or a password that is used to encrypt the key data. When using this external media, however, access to the local resources of a user is necessary. However, this is not desirable in the case of a network-oriented infrastructure of network computers or Java applications.

A network computer is a computer that is networked with other computers.

A Java application is a program that contains programs written in the Java programming language.

Thus, the method described in [2] has the disadvantage that the secret key has to be stored on an external medium and the secret key is therefore difficult to protect against misuse.

An overview of hash functions can be found in m [3]. A hash function is a function in which it is not possible to calculate a suitable input value for a given function value. Furthermore, an output string of any length is ge fixed length assigned. Furthermore, additional properties can be required for the hash function. Such an additional property is collision-free, ie it must not be possible to find two different exit character strings that result in the same exit character string.

Examples of a hash function are the method according to the MD-2 standard, the method according to the MD-5 standard, the Data Encryption Standard (DES), which is carried out without the use of a key, or any other hash -Function .

A method known as the Miller-Rabm method, which can be used to check whether a number is a prime number, is known from [4].

The invention is therefore based on the problem of forming a secret communication key to a previously determined asymmetrical cryptographic key pair, in which the secret key of the asymmetrical key pair does not have to be stored permanently.

The problem is solved by the method and by the arrangement with the features of the independent claims.

In the method for forming a secret communication key for a previously determined asymmetrical cryptographic key pair, which comprises a secret key and a corresponding public key, a predeterminable starting value was used when determining the key pair. The start value is made available to a user. The user enters the start value into the computer and the secret communication key is formed using the start value. The secret communication cation key and the public key form a communication key pair.

The arrangement for forming a secret communication key to a previously determined asymmetrical cryptographic key pair, which comprises a secret key and a corresponding public key, has a processor which is set up in such a way that the following steps can be carried out: - in determining the Key pair a predeterminable starting value was used,

- the start value is made available to a user,

the start value is entered by the user m the computer, using the start value the secret communication key is formed, the secret communication key and the public key forming a pair of communication keys. Furthermore, an input means is provided for the user to enter the starting value.

The invention makes it possible to be able to delete the secret key without having to do without the strong cryptography of the public key technology.

Clearly, the starting value can be viewed as a personal identification number (Personal Identification Number PIN) specified by the user or centrally specified or as a password which the user enters into the computer. After entering the password or PIN, using the password or PIN as the starting value, the secret communication key, ie the key with the same name as the secret key, is formed, which forms a key pair, the communication key pair, together with the public key. In this way, the invention achieves a fusion of the password technology used for the user of a conventional computer network or a conventional computer with the strong cryptology, without having to make considerable efforts to permanently store secret key material.

Preferred developments of the invention result from the dependent claims.

In a further development of the invention, it is provided that a hash function is applied to the starting value, whereby a value is formed which is ultimately used for key generation.

Further, additional data can be used tion in Schlusselgeneπe- that preferably the user rakterisieren cha ^¬ itself.

The RSA method for key generation is preferably used to form the cryptographic key.

As a hash function, the method according to the MD-5 standard, the MD-2 standard or also the Data Encryption Standard (DES) can be used as an emweg function.

The pair of communication keys can be used both for encryption or to ensure the integrity of electronic data, to form a digital signature via electronic data or to authenticate a user, generally for any cryptographic operation in which the public key technology is used, the formed Communication key pair is used.

In order to accelerate the method, it is advantageous in one embodiment to store an index when the secret closing ice is formed, which index is subsequently used as an acceleration indicator is referred to. The acceleration key figure indicates how often numbers, based on the starting value, have been checked to determine whether the respective number represents a prime number or not.

The Miller-Rabm method is preferably used to check the property of whether a number represents a prime number.

An exemplary embodiment of the invention is shown in the figures and is explained in more detail below.

Show it

Figure 1 is a flowchart showing the process steps of the exemplary embodiment;

FIG. 2 shows a sketch showing a computer network with a large number of computers coupled to one another;

FIG. 3 shows a symbolic diagram showing the procedure for determining a prime number based on a starting value.

2 shows a plurality of computers 200, 210, 220, 230, 240, 250, which are connected to one another via a communication network 260. Each computer 200, 210, 220, 230, 240, 250 each has several input means, ie a keyboard 206, 216, 226, 236, 246, 256, a mouse 207, 217, 227, 237, 247, 257 or a scanner ( not shown) or a camera (not shown). The input information is fed and stored via the respective emitting means via an input / output interface 201, 211, 221, 231, 241, 251 to a memory 202, 212, 222, 232, 242, 252. The 202, 212, 222, 232, 242, 252 memory is connected to the input / output interface 201, 211, 221, 231, 241, 251 via a bus 204, 214, 224, 234, 244, 254. As well A processor 203, 213, 223, 233, 243, 253 is connected to the bus 204, 214, 224, 234, 244, 254 and is set up in such a way that the method steps described below can be carried out.

The computers 200, 210, 220, 230, 240, 250 communicate via the communication network 260 in accordance with the Transport Control Protocol / Internet Protocol (TCP / IP).

Furthermore, a certification unit 270 is provided in the communication network 260, with which a certificate is issued for each public key, so that the public key is trustworthy for communication on the basis of public key technology.

A user 280 enters a predeterminable word (PIN, password) in the first computer 200 (only known to the user) (step 101, cf. FIG. 1).

An asymmetrical cryptographic key pair is generated by the first computer 200 in accordance with the RSA method, as described below.

The value 102 entered by the user 280 and additional data 103 which characterize the user 280, for example user name, personnel number, terminal address, etc., are fed to a hash function (step 104).

An overview of hash functions can be found in m [3]. A hash function is a function in which it is not possible to calculate a suitable input value for a given function value. Furthermore, an output string of a fixed length is assigned to an arbitrarily long output string. Additional properties can also be required for the hash function. Such an additional property is collision-free, ie it must not be possible to have two different incoming to find strings that result in the same parent string.

Examples of a hash function are the method according to the MD-2 standard, the method according to the MD-5 standard, the Data Encryption Standard (DES), which is carried out without the use of a key, or any other hash function .

The value formed by the hash function is used as the base value BW to form two prime numbers, as symbolically shown in FIG.

As shown in FIG. 3, starting from the base value BW, an iterative process is used to check whether the respective value represents a prime number or not for a value Wi (l = 1,..., N) (step 301).

The method according to Miller-Rabm, which is described in [4], is used as a method for checking the property Pπm for a number.

If it is found for a number that the number is not a prime number, the number is increased by a predeterminable value, preferably by the value 2 (step 302) and the test for the property “Pπm” is repeated (step 301). This procedure is repeated until two prime numbers, a first prime number p and a second prime number q have been determined.

An index is a number with which it is specified how often, starting from the base value PW, the number must be increased by the predetermined value until one arrives at the first prime number p or the second prime number q.

The result of the method shown in FIG. 3 is two

Prime numbers p and q, which are used for key generation according to the RSA method (step 105). The prime numbers p and q usually have a length of several

A modulus n is formed from the prime numbers p and q according to the following rule:

n = p * q. (1)

Furthermore, an intermediate variable φ (n) is formed in accordance with the following regulation:

φ (n) = (p-1) * (q-1). (2)

A secret key d is now chosen such that the secret key d is prime to φ (n). A public key e is determined in such a way that the following requirement is met:

e * d mop φ (n) = 1. (3)

The value d is the secret key and must not be disclosed to any third party.

Thus, a private key d (step 106) and a public key e (step 107) have been formed by the key generation (step 105).

The two keys d, e form a corresponding cryptographic key pair, which is used for any cryptographic operation, i.e. is used for encryption, decryption or also for digital signature or for authentication (step 108).

After the key pair d, e has been formed in accordance with the method described above, the secret key d is deleted. The public key e is supplied to the certification authority 280. A certificate Certe for the public key e is formed by the certification authority 280 and the certificate Certe for the public key ice e is stored in a publicly accessible directory 290.

Thus, each communication participant in the communication network 280 can access the public key e via the certificate Certe of the public key e.

The secret key d corresponding to the public key e has been deleted in the first computer 200.

Every time the user 280 wants to start communication on the basis of the key pair or wants to carry out a cryptographic operation using such a key pair, the user 208 m gives the first computer 200 its starting value (PIN, password ) and the start value 102 is again provided with additional data 103 as described above and subjected to a hash function

(Step 104) and either two prime numbers p and q are determined starting from the base value BW, or a stored index, as described above, is read out or likewise entered by the user 280 and a secret communication key is formed from this, which corresponds to the secret, previously formed but deleted key d corresponds.

In this way, a pair of communication keys has been formed, which includes the secret communication key and the corresponding public key e. This means that the secret communication key can currently be generated for a communication session by a user, which makes it possible to use strong public key technology without having to store the secret key on a chip card. The communication key pair d, e thus formed is used to encrypt plain text 109 with the public key e and to decrypt the electronic, encrypted data 110 with the secret communication key.

The processing of plain text 109, i.e. Electronic data 109 readable for everyone and encrypted electronic data 110 are represented symbolically in FIG. 1, the direction of communication in each case being described by an arrow hm or by the block, which represents a cryptographic operation 108.

The encryption or decryption takes place according to the following regulations:

m ^e mod n = c, (4)

being with

m a quantity of 512 bits of electronic data 109 to be encrypted,

c encrypted electronic data 110,

be designated.

The encrypted electronic data c is decrypted according to the following rule:

m = c ^ mod n. (5)

Some alternatives to the exemplary embodiment shown above are explained below:

The method can be used for encryption as well as for securing integrity or for digitally signing electronic data. Furthermore, the invention can be used in the field of secure electronic mail systems.

The start value 102 does not necessarily have to be entered by the user when the key pair is generated at the start of the method, but can also be specified to the user by a central unit which generates the key pair.

Thus, the user only has to remember a password or a PIN and it is no longer necessary to securely store a secret cryptographic key, for example on a chip card, which is associated with corresponding risks and with considerable effort.

Instead of a hash function, any one-way function can be used within the scope of the invention.

The following publications have been cited in this document.

[1] C. Ruland, Information Security in Data Networks, ISBN 3-89238-081-3, DATACOM-Verlag, pp. 79-85, 1993

[2] D. Longley and M. Shain, Data & Computer Security,

Dictionary of Standards concepts and terms, Stockton Press, ISBN 0-333-42935-4, p. 317, 1987

[3] C. Ruland, Information Security in Data Networks,

ISBN 3-89238-081-3, DATACOM-Verlag, pp. 68 - 73, 1993

[4] A.J. Menezes, P. van Oorschot and S. Vanstone, Handbook of Applied Cryptography, CRC Press, ISBN 0-8493-8523-7, pp. 138-140, 1997

Claims

claims

1. Method for forming a secret communication key to a previously determined asymmetrical cryptographic key pair, which comprises a secret key and a corresponding public key, by a computer, a) in which a predeterminable starting value was used in the determination of the key pair , b) in which the start value is made available to a user, c) in which the user enters the start value m into the computer, d) in which the secret communication key is formed using the start value, the secret communication key and the public one Keys form an asymmetrical cryptographic communication key pair.

2. The method according to claim 1, in which the starting value is supplied to a hash function and the value formed by the hash function is used in determining the key pair and the communication key pair.

3. The method according to claim 1 or 2, in which additional data characterizing the user are used in the formation of the key pair and the communication key pair.

4. The method according to any one of claims 1 to 3, - in which a prime number is determined on the basis of the starting value, wherein in each case iterative method is used to check whether the number checked in each case is a prime number and if this is the case, a Index that stores a number of numbers, which have been checked for their properties, whether they are prime,

- otherwise a further number is selected based on the checked number and the index is increased by a predetermined number,

- in which the prime number used is deleted after the formation of the communication key pair,

- In the case of the new formation of a communication key pair, the index and the starting value are used to form the secret communication key.

5. The method of claim 4, wherein the test of whether a number is a prime is performed according to the Miller-Rabm method.

6. The method according to any one of claims 1 to 5, in which the keys are formed according to the RSA method.

7. The method according to any one of claims 2 to 6, wherein the hash function is one of the following methods:

- MD-5 process,

- MD-2 process,

- The procedure according to the Data Encryption Standard (DES) as an emweg function.

8. The method according to any one of claims 1 to 7, used to encrypt electronic data with the secret communication key.

9. The method according to any one of claims 1 to 7, used to form a digital signature via electronic data using the secret communication key.

10. The method according to any one of claims 1 to 7, used for authentication using the secret communication key.

11. Arrangement for forming a secret communication key for a previously determined asymmetrical cryptographic key pair, which comprises a secret key and a corresponding public key, with a processor which is set up in such a way that the following steps can be carried out: - The key pair was used of a predeterminable starting value,

- the start value is made available to a user,

the starting value is given by the user m to the computer,

- Using the start value, the secret communication key is formed, the secret communication key and the public key forming a pair of communication keys, and with an emitting means for inputting the start value by the user.

12. The arrangement according to claim 11, wherein the processor is set up such that the starting value is supplied to a hash function and by the

Hash function formed value is used in the determination of the key pair and the communication key pair.

13. The arrangement as claimed in claim 11 or 12, in which the processor is set up in such a way that additional data which characterize the user are used in the formation of the key pair and the communication key pair.

14. Arrangement according to one of claims 11 to 13, wherein the processor is set up such that a prime number is determined on the basis of the starting value, an iterative process being used to check whether the number checked is a prime number and, if this is the case, an index is stored with which a number of numbers is designated, which have been checked for their properties, whether they are prime,

- after the formation of the communication key pair, the prime number used is deleted,

- When creating a new communication key pair, the index and the start value are used to form the secret communication key.

15. Arrangement according to claim 14, in which the processor is set up in such a way that the test as to whether a number is a prime number is carried out in accordance with the Miller-Rabin method.

16. Arrangement according to one of claims 11 to 15, wherein the processor is set up in such a way that the keys are formed in accordance with the RSA method.

17. Arrangement according to one of claims 12 to 16, in which the processor is set up in such a way that the hash function is one of the following methods:

- MD-5 process, - MD-2 process,

- The procedure according to the Data Encryption Standard (DES) as a one-way function.

18. Arrangement according to one of claims 11 to 17, used for encrypting electronic data with the secret communication key.

19. Arrangement according to one of claims 11 to 17, used to form a digital signature via electronic data using the secret communication key.

20. Arrangement according to one of claims 11 to 17, used for authentication using the secret communication key.